It changes with each new session. 
  
In config/blesta.php look for this line:  
Configure::set("Blesta.csrf_bypass", array());
You can add controllers and actions to this array to bypass CSRF checks, for the client login it should be array('client_login::index') so the following should work: 
Configure::set("Blesta.csrf_bypass", array('client_login::index'));